@reventlessdev/reventless-local 3.0.0-alpha.217 → 3.0.0-alpha.219

package/tests/ShellConfigTest.res.mjs

@@ -0,0 +1,203 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Nodefs from "node:fs";
+import * as Nodeos from "node:os";
+import * as Nodepath from "node:path";
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as TestRunner$ReventlessLocal from "../src/test/TestRunner.res.mjs";
+import * as ShellConfig$ReventlessLocal from "../src/ShellConfig.res.mjs";
+
+TestRunner$ReventlessLocal.setup();
+
+function manifest(key) {
+  return {
+    components: [{
+        plugin: "Catalog",
+        views: ["Products"],
+        commands: []
+      }],
+    key: key
+  };
+}
+
+function str(d, k) {
+  return Stdlib_Option.flatMap(d[k], Stdlib_JSON.Decode.string);
+}
+
+function threw(f) {
+  try {
+    f();
+    return false;
+  } catch (exn) {
+    return true;
+  }
+}
+
+globalThis.describe("ShellConfig.overlay", () => {
+  globalThis.test("is empty when the deployment declares nothing", () => {
+    let out = ShellConfig$ReventlessLocal.overlay(undefined, undefined);
+    globalThis.expect(Object.keys(out)).toEqual([]);
+  });
+  globalThis.test("points manifestUrl at the bake's default key", () => {
+    let out = ShellConfig$ReventlessLocal.overlay(manifest(undefined), undefined);
+    globalThis.expect(str(out, "manifestUrl")).toEqual("/component-manifest.json");
+  });
+  globalThis.test("follows a renamed bake", () => {
+    let out = ShellConfig$ReventlessLocal.overlay(manifest("storefront.json"), undefined);
+    globalThis.expect(str(out, "manifestUrl")).toEqual("/storefront.json");
+  });
+  globalThis.test("passes the deployment's own keys through verbatim", () => {
+    let out = ShellConfig$ReventlessLocal.overlay(undefined, Object.fromEntries([
+      [
+        "appName",
+        "Online Shop"
+      ],
+      [
+        "elevatedGroups",
+        ["Admin"].map(prim => prim)
+      ]
+    ]));
+    globalThis.expect(str(out, "appName")).toEqual("Online Shop");
+    globalThis.expect(Stdlib_Option.isSome(out["elevatedGroups"])).toBe(true);
+  });
+  globalThis.test("refuses a shellConfig key the platform computes", () => {
+    globalThis.expect(threw(() => {
+      ShellConfig$ReventlessLocal.overlay(manifest(undefined), Object.fromEntries([[
+          "manifestUrl",
+          "/elsewhere.json"
+        ]]));
+    })).toBe(true);
+  });
+});
+
+globalThis.describe("ShellConfig.emit", () => {
+  let shipped = `{\n  "apiEndpoint": "/graphql",\n  "appName": "Shipped"\n}`;
+  let distWithConfig = () => {
+    let dir = Nodefs.mkdtempSync(Nodepath.join(Nodeos.tmpdir(), "reventless-shellconfig-"));
+    Nodefs.writeFileSync(Nodepath.join(dir, "config.json"), shipped, "utf8");
+    return dir;
+  };
+  let readJson = path => Stdlib_Option.getOrThrow(Stdlib_JSON.Decode.object(JSON.parse(Nodefs.readFileSync(path, "utf8"))), undefined);
+  let readConfig = dir => readJson(Nodepath.join(dir, "config.json"));
+  let readBaseline = dir => readJson(Nodepath.join(dir, "config.base.json"));
+  let named = name => Object.fromEntries([[
+      "appName",
+      name
+    ]]);
+  globalThis.test("merges the overlay onto the shipped file and keeps its other keys", () => {
+    let dir = distWithConfig();
+    ShellConfig$ReventlessLocal.emit(manifest(undefined), undefined, dir);
+    let out = readConfig(dir);
+    globalThis.expect(str(out, "manifestUrl")).toEqual("/component-manifest.json");
+    globalThis.expect(str(out, "apiEndpoint")).toEqual("/graphql");
+  });
+  globalThis.test("leaves a platform that declares nothing entirely alone", () => {
+    let dir = distWithConfig();
+    ShellConfig$ReventlessLocal.emit(undefined, undefined, dir);
+    globalThis.expect(Nodefs.readFileSync(Nodepath.join(dir, "config.json"), "utf8")).toEqual(shipped);
+    globalThis.expect(Nodefs.existsSync(Nodepath.join(dir, "config.base.json"))).toBe(false);
+  });
+  globalThis.test("starts every boot from the shipped file, not the last output", () => {
+    let dir = distWithConfig();
+    ShellConfig$ReventlessLocal.emit(undefined, named("First"), dir);
+    ShellConfig$ReventlessLocal.emit(undefined, named("Second"), dir);
+    globalThis.expect(str(readConfig(dir), "appName")).toEqual("Second");
+    globalThis.expect(str(readBaseline(dir), "appName")).toEqual("Shipped");
+  });
+  globalThis.test("restores the shipped file once the declaration is withdrawn", () => {
+    let dir = distWithConfig();
+    ShellConfig$ReventlessLocal.emit(manifest(undefined), undefined, dir);
+    ShellConfig$ReventlessLocal.emit(undefined, undefined, dir);
+    let out = readConfig(dir);
+    globalThis.expect(out["manifestUrl"]).toEqual(undefined);
+    globalThis.expect(str(out, "appName")).toEqual("Shipped");
+  });
+  globalThis.test("refuses to overlay a dist that ships no config.json", () => {
+    let dir = Nodefs.mkdtempSync(Nodepath.join(Nodeos.tmpdir(), "reventless-shellconfig-"));
+    globalThis.expect(threw(() => ShellConfig$ReventlessLocal.emit(manifest(undefined), undefined, dir))).toBe(true);
+  });
+});
+
+function withJourneys(journeys) {
+  return {
+    components: [{
+        plugin: "Catalog",
+        views: ["Products"],
+        commands: []
+      }],
+    journeys: journeys
+  };
+}
+
+let shopper_components = [{
+    plugin: "Catalog",
+    views: ["Products"],
+    commands: []
+  }];
+
+let shopper = {
+  group: "Shopper",
+  components: shopper_components
+};
+
+let fulfilment_components = [{
+    plugin: "Ordering",
+    views: ["Orders"],
+    commands: ["ShipOrder"]
+  }];
+
+let fulfilment_key = "fulfilment.json";
+
+let fulfilment = {
+  group: "Fulfilment",
+  components: fulfilment_components,
+  key: fulfilment_key
+};
+
+globalThis.describe("ShellConfig.overlay — journeys", () => {
+  globalThis.test("a bake declaring no journeys writes no map", () => {
+    let out = ShellConfig$ReventlessLocal.overlay(manifest(undefined), undefined);
+    globalThis.expect(out["journeyManifestUrls"]).toEqual(undefined);
+  });
+  globalThis.test("an empty journeys array is the same as none", () => {
+    let out = ShellConfig$ReventlessLocal.overlay(withJourneys([]), undefined);
+    globalThis.expect(out["journeyManifestUrls"]).toEqual(undefined);
+  });
+  globalThis.test("keeps manifestUrl as the default journey", () => {
+    let out = ShellConfig$ReventlessLocal.overlay(withJourneys([shopper]), undefined);
+    globalThis.expect(str(out, "manifestUrl")).toEqual("/component-manifest.json");
+  });
+  globalThis.test("maps each declared group to its own file", () => {
+    let out = ShellConfig$ReventlessLocal.overlay(withJourneys([
+      shopper,
+      fulfilment
+    ]), undefined);
+    let map = Stdlib_Option.getOrThrow(Stdlib_Option.flatMap(out["journeyManifestUrls"], Stdlib_JSON.Decode.object), undefined);
+    globalThis.expect([
+      str(map, "Shopper"),
+      str(map, "Fulfilment")
+    ]).toEqual([
+      "/component-manifest-shopper.json",
+      "/fulfilment.json"
+    ]);
+  });
+  globalThis.test("refuses a shellConfig that sets the journey map itself", () => {
+    globalThis.expect(threw(() => {
+      ShellConfig$ReventlessLocal.overlay(withJourneys([shopper]), Object.fromEntries([[
+          "journeyManifestUrls",
+          {}
+        ]]));
+    })).toBe(true);
+  });
+});
+
+export {
+  manifest,
+  str,
+  threw,
+  withJourneys,
+  shopper,
+  fulfilment,
+}
+/*  Not a pure module */

package/tests/UiHintsTest.res

@@ -0,0 +1,94 @@
+open JestGlobals
+
+// The `ui-hints.json` the local platform serves. Two things are under test:
+// which file wins (the declaration or the host-shell package's own dev-mode
+// fallback), and the baseline that makes a second boot — and a *withdrawn*
+// declaration — land where they should. Every failure here is quiet: hints are
+// presentation, so the symptom is a menu that reads slightly wrong.
+
+let _ = TestRunner.setup()
+
+let shipped = `{"Catalog": {"views": {"Products": {"nav": {"label": "Shipped"}}}}}`
+let declared = `{"Catalog": {"views": {"Products": {"nav": {"label": "Declared"}}}}}`
+
+let tmpdir = prefix => NodeFs.mkdtempSync(NodePath.join([NodeOs.tmpdir(), prefix]))
+
+let distWithHints = () => {
+  let dir = tmpdir("reventless-uihints-dist-")
+  NodeFs.writeFileSync(NodePath.join([dir, "ui-hints.json"]), shipped)
+  dir
+}
+
+let declaredFile = (contents: string) => {
+  let path = NodePath.join([tmpdir("reventless-uihints-src-"), "ui-hints.json"])
+  NodeFs.writeFileSync(path, contents)
+  path
+}
+
+let served = (dir: string) => NodeFs.readFileSync(NodePath.join([dir, "ui-hints.json"]))
+let baselinePath = (dir: string) => NodePath.join([dir, "ui-hints.base.json"])
+
+let threw = (f: unit => unit): bool =>
+  try {
+    f()
+    false
+  } catch {
+  | _ => true
+  }
+
+describe("UiHints.emit", () => {
+  testSync("serves the declared file verbatim", () => {
+    let dir = distWithHints()
+    UiHints.emit(~uiHintsFile=Some(declaredFile(declared)), ~dir)
+    expect(served(dir))->toEqual(declared)
+  })
+
+  // An undeclared platform has to be byte-identical to one built before this
+  // module existed, or every shell repo demonstration breaks to fix a problem
+  // it does not have.
+  testSync("leaves a platform that declares nothing entirely alone", () => {
+    let dir = distWithHints()
+    UiHints.emit(~uiHintsFile=None, ~dir)
+    expect(served(dir))->toEqual(shipped)
+    expect(NodeFs.existsSync(baselinePath(dir)))->toBe(false)
+  })
+
+  // Boot 2 seeding its baseline from boot 1's output would freeze the first
+  // declaration in as "shipped" and make the withdrawal below unreachable.
+  testSync("starts every boot from the shipped file, not the last output", () => {
+    let dir = distWithHints()
+    UiHints.emit(~uiHintsFile=Some(declaredFile(declared)), ~dir)
+    UiHints.emit(~uiHintsFile=Some(declaredFile(shipped)), ~dir)
+    expect(NodeFs.readFileSync(baselinePath(dir)))->toEqual(shipped)
+  })
+
+  testSync("restores the shipped file once the declaration is withdrawn", () => {
+    let dir = distWithHints()
+    UiHints.emit(~uiHintsFile=Some(declaredFile(declared)), ~dir)
+    UiHints.emit(~uiHintsFile=None, ~dir)
+    expect(served(dir))->toEqual(shipped)
+  })
+
+  // All three failures below produce the same symptom if swallowed — hints that
+  // quietly are not applied — so each has to be the boot's problem, not the
+  // reader's.
+  testSync("refuses a declaration naming a file that does not exist", () => {
+    let dir = distWithHints()
+    let missing = NodePath.join([tmpdir("reventless-uihints-src-"), "absent.json"])
+    expect(threw(() => UiHints.emit(~uiHintsFile=Some(missing), ~dir)))->toBe(true)
+  })
+
+  testSync("refuses a declared file that is not JSON", () => {
+    let dir = distWithHints()
+    expect(threw(() => UiHints.emit(~uiHintsFile=Some(declaredFile("not json")), ~dir)))->toBe(true)
+  })
+
+  // Read before anything is touched: a bad declaration must not leave the
+  // served file half-replaced, which would be worse than either outcome.
+  testSync("leaves the served file untouched when the declaration is bad", () => {
+    let dir = distWithHints()
+    let _ = threw(() => UiHints.emit(~uiHintsFile=Some(declaredFile("not json")), ~dir))
+    expect(served(dir))->toEqual(shipped)
+    expect(NodeFs.existsSync(baselinePath(dir)))->toBe(false)
+  })
+})

package/tests/UiHintsTest.res.mjs

@@ -0,0 +1,99 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Nodefs from "node:fs";
+import * as Nodeos from "node:os";
+import * as Nodepath from "node:path";
+import * as UiHints$ReventlessLocal from "../src/UiHints.res.mjs";
+import * as TestRunner$ReventlessLocal from "../src/test/TestRunner.res.mjs";
+
+TestRunner$ReventlessLocal.setup();
+
+let shipped = `{"Catalog": {"views": {"Products": {"nav": {"label": "Shipped"}}}}}`;
+
+let declared = `{"Catalog": {"views": {"Products": {"nav": {"label": "Declared"}}}}}`;
+
+function tmpdir(prefix) {
+  return Nodefs.mkdtempSync(Nodepath.join(Nodeos.tmpdir(), prefix));
+}
+
+function distWithHints() {
+  let dir = tmpdir("reventless-uihints-dist-");
+  Nodefs.writeFileSync(Nodepath.join(dir, "ui-hints.json"), shipped, "utf8");
+  return dir;
+}
+
+function declaredFile(contents) {
+  let path = Nodepath.join(tmpdir("reventless-uihints-src-"), "ui-hints.json");
+  Nodefs.writeFileSync(path, contents, "utf8");
+  return path;
+}
+
+function served(dir) {
+  return Nodefs.readFileSync(Nodepath.join(dir, "ui-hints.json"), "utf8");
+}
+
+function baselinePath(dir) {
+  return Nodepath.join(dir, "ui-hints.base.json");
+}
+
+function threw(f) {
+  try {
+    f();
+    return false;
+  } catch (exn) {
+    return true;
+  }
+}
+
+globalThis.describe("UiHints.emit", () => {
+  globalThis.test("serves the declared file verbatim", () => {
+    let dir = distWithHints();
+    UiHints$ReventlessLocal.emit(declaredFile(declared), dir);
+    globalThis.expect(served(dir)).toEqual(declared);
+  });
+  globalThis.test("leaves a platform that declares nothing entirely alone", () => {
+    let dir = distWithHints();
+    UiHints$ReventlessLocal.emit(undefined, dir);
+    globalThis.expect(served(dir)).toEqual(shipped);
+    globalThis.expect(Nodefs.existsSync(Nodepath.join(dir, "ui-hints.base.json"))).toBe(false);
+  });
+  globalThis.test("starts every boot from the shipped file, not the last output", () => {
+    let dir = distWithHints();
+    UiHints$ReventlessLocal.emit(declaredFile(declared), dir);
+    UiHints$ReventlessLocal.emit(declaredFile(shipped), dir);
+    globalThis.expect(Nodefs.readFileSync(Nodepath.join(dir, "ui-hints.base.json"), "utf8")).toEqual(shipped);
+  });
+  globalThis.test("restores the shipped file once the declaration is withdrawn", () => {
+    let dir = distWithHints();
+    UiHints$ReventlessLocal.emit(declaredFile(declared), dir);
+    UiHints$ReventlessLocal.emit(undefined, dir);
+    globalThis.expect(served(dir)).toEqual(shipped);
+  });
+  globalThis.test("refuses a declaration naming a file that does not exist", () => {
+    let dir = distWithHints();
+    let missing = Nodepath.join(tmpdir("reventless-uihints-src-"), "absent.json");
+    globalThis.expect(threw(() => UiHints$ReventlessLocal.emit(missing, dir))).toBe(true);
+  });
+  globalThis.test("refuses a declared file that is not JSON", () => {
+    let dir = distWithHints();
+    globalThis.expect(threw(() => UiHints$ReventlessLocal.emit(declaredFile("not json"), dir))).toBe(true);
+  });
+  globalThis.test("leaves the served file untouched when the declaration is bad", () => {
+    let dir = distWithHints();
+    threw(() => UiHints$ReventlessLocal.emit(declaredFile("not json"), dir));
+    globalThis.expect(served(dir)).toEqual(shipped);
+    globalThis.expect(Nodefs.existsSync(Nodepath.join(dir, "ui-hints.base.json"))).toBe(false);
+  });
+});
+
+export {
+  shipped,
+  declared,
+  tmpdir,
+  distWithHints,
+  declaredFile,
+  served,
+  baselinePath,
+  threw,
+}
+/*  Not a pure module */

package/tests/adapter/LocalAuthLoginTest.res

@@ -178,3 +178,217 @@ testPromise("setCredentials mirrors identity into the X-User registry", async ()
   | _ => JsError.throwWithMessage("expected Authenticated(alice) via X-User")
   }
 })
+
+// ── Acting as one of the roles you hold ───────────────────────────────────
+//
+// The subset rule is the security-critical line of the feature: narrowing only,
+// never widening, so a client that tampers with the request can only ever reduce
+// its own privilege. The table below is the same one the Cognito minting path
+// has to satisfy — the two implementations cannot be shared across a process
+// boundary, so the cases are what keeps them from drifting.
+
+let multiRole: Reventless.Identity.t = {
+  userId: "u-carol",
+  username: "carol",
+  groups: ["Fulfilment", "Shopper"],
+  provider: InMemory,
+}
+
+let decodeOrThrow = token =>
+  switch LocalAuth.Login.verifyAndDecode(token) {
+  | Some(i) => i
+  | None => JsError.throwWithMessage("expected a verifiable token")
+  }
+
+let carolLoggedIn = () => {
+  resetAll()
+  LocalAuth.Login.setCredentials(~username="carol", ~password="carol-pw", ~identity=multiRole)
+}
+
+// The regression line. Every login that existed before this feature takes this
+// path, and it has to mint what it always minted.
+testPromise("a login naming no role mints exactly what it minted before", async () => {
+  carolLoggedIn()
+  let plain = switch await LocalAuth.Login.issue(~username="carol", ~password="carol-pw") {
+  | Ok(t) => t
+  | Error(e) => JsError.throwWithMessage(e)
+  }
+  let identity = decodeOrThrow(plain)
+  expect(identity.groups)->toEqual(["Fulfilment", "Shopper"])
+  expect(identity.claims)->toEqual(None)
+})
+
+testPromise("a login naming a held role mints that role alone", async () => {
+  carolLoggedIn()
+  let token = switch await LocalAuth.Login.issue(
+    ~username="carol",
+    ~password="carol-pw",
+    ~activeRole="Shopper",
+  ) {
+  | Ok(t) => t
+  | Error(e) => JsError.throwWithMessage(e)
+  }
+  let identity = decodeOrThrow(token)
+  // `groups` is what every enforcement point reads, so this is the assertion
+  // that the narrowing is real rather than cosmetic.
+  expect(identity.groups)->toEqual(["Shopper"])
+})
+
+testPromise("a narrowed token remembers the choice and what it gave up", async () => {
+  carolLoggedIn()
+  let token = switch await LocalAuth.Login.issue(
+    ~username="carol",
+    ~password="carol-pw",
+    ~activeRole="Shopper",
+  ) {
+  | Ok(t) => t
+  | Error(e) => JsError.throwWithMessage(e)
+  }
+  let identity = decodeOrThrow(token)
+  expect((
+    identity->Reventless.Identity.getClaim("activeRole"),
+    identity->Reventless.Identity.getClaim("availableRoles"),
+  ))->toEqual((Some("Shopper"), Some("Fulfilment,Shopper")))
+})
+
+// The line that decides whether this is a security feature or a suggestion.
+// Refused, specifically — not ignored and minted at full membership, which is
+// the failure that would hand a tampering client everything it asked for.
+testPromise("a login naming a role the user does not hold is REFUSED", async () => {
+  carolLoggedIn()
+  switch await LocalAuth.Login.issue(
+    ~username="carol",
+    ~password="carol-pw",
+    ~activeRole="Admin",
+  ) {
+  | Ok(_) => JsError.throwWithMessage("expected a request to widen to be refused")
+  | Error(msg) => expect(msg->String.includes("Admin"))->toEqual(true)
+  }
+})
+
+// Narrowing to a role you hold while *also* naming one you do not is the same
+// widening attempt wearing a disguise; there is no partial credit.
+testPromise("narrowing cannot smuggle a group in through the claims bag", async () => {
+  resetAll()
+  let withClaims: Reventless.Identity.t = {
+    ...multiRole,
+    claims: Dict.fromArray([("availableRoles", "Admin,Fulfilment,Shopper")]),
+  }
+  LocalAuth.Login.setCredentials(~username="carol", ~password="carol-pw", ~identity=withClaims)
+  switch await LocalAuth.Login.issue(
+    ~username="carol",
+    ~password="carol-pw",
+    ~activeRole="Admin",
+  ) {
+  | Ok(_) =>
+    JsError.throwWithMessage("expected membership to be judged by groups, not by a claim")
+  | Error(_) => expect(true)->toEqual(true)
+  }
+})
+
+// A narrowed token has to survive the same round trip an ordinary one does, or
+// the narrowing would hold only until the next request.
+testPromise("a narrowed token authenticates as the narrowed identity", async () => {
+  carolLoggedIn()
+  let token = switch await LocalAuth.Login.issue(
+    ~username="carol",
+    ~password="carol-pw",
+    ~activeRole="Shopper",
+  ) {
+  | Ok(t) => t
+  | Error(e) => JsError.throwWithMessage(e)
+  }
+  let result = await LocalAuth.authenticate(
+    buildContext([("authorization", "Bearer " ++ token)]),
+  )
+  switch result {
+  | Authenticated(identity) => expect(identity.groups)->toEqual(["Shopper"])
+  | _ => JsError.throwWithMessage("expected the narrowed token to authenticate")
+  }
+})
+
+// The login response echoes this, and it has to describe the token it ships
+// beside rather than the account behind it.
+testPromise("the minted identity matches the token, not the stored user", async () => {
+  carolLoggedIn()
+  let minted = LocalAuth.Login.mintedIdentity(~username="carol", ~activeRole=Some("Shopper"))
+  let stored = LocalAuth.lookupUser("carol")
+  expect((
+    minted->Option.mapOr([], i => i.groups),
+    stored->Option.mapOr([], i => i.groups),
+  ))->toEqual((["Shopper"], ["Fulfilment", "Shopper"]))
+})
+
+// ── Switching an existing session ─────────────────────────────────────────
+//
+// A switch is not a re-authentication: the client holds a token, not a
+// password. Possession of a token this server signed is proof of the
+// credentials that produced it, so the switch re-mints from the token — and
+// re-reads membership from the store, never from the token's own record of it.
+
+testPromise("a session can be re-minted as one of its roles", async () => {
+  carolLoggedIn()
+  let wide = switch await LocalAuth.Login.issue(~username="carol", ~password="carol-pw") {
+  | Ok(t) => t
+  | Error(e) => JsError.throwWithMessage(e)
+  }
+  switch LocalAuth.Login.reissue(~token=wide, ~activeRole=Some("Shopper")) {
+  | Ok(t) => expect(decodeOrThrow(t).groups)->toEqual(["Shopper"])
+  | Error(e) => JsError.throwWithMessage(e)
+  }
+})
+
+// Switching back is the other half of a switcher, and it is not an escalation:
+// the set being widened to is the one the store says the caller holds.
+testPromise("a narrowed session can widen back to its full membership", async () => {
+  carolLoggedIn()
+  let narrow = switch await LocalAuth.Login.issue(
+    ~username="carol",
+    ~password="carol-pw",
+    ~activeRole="Shopper",
+  ) {
+  | Ok(t) => t
+  | Error(e) => JsError.throwWithMessage(e)
+  }
+  switch LocalAuth.Login.reissue(~token=narrow, ~activeRole=None) {
+  | Ok(t) =>
+    let identity = decodeOrThrow(t)
+    expect((identity.groups, identity.claims))->toEqual((["Fulfilment", "Shopper"], None))
+  | Error(e) => JsError.throwWithMessage(e)
+  }
+})
+
+// 🚨 The assertion that keeps `availableRoles` from becoming an authority. A
+// narrowed token carries the record of what it gave up; if the switch trusted
+// that record instead of the store, a token forged with a wider claim — or a
+// role revoked since issuance — would widen right back into it.
+testPromise("switching judges membership from the store, not the token's claim", async () => {
+  carolLoggedIn()
+  let narrow = switch await LocalAuth.Login.issue(
+    ~username="carol",
+    ~password="carol-pw",
+    ~activeRole="Shopper",
+  ) {
+  | Ok(t) => t
+  | Error(e) => JsError.throwWithMessage(e)
+  }
+  // The store loses the role while the token still remembers it.
+  LocalAuth.Login.setCredentials(
+    ~username="carol",
+    ~password="carol-pw",
+    ~identity={...multiRole, groups: ["Shopper"]},
+  )
+  switch LocalAuth.Login.reissue(~token=narrow, ~activeRole=Some("Fulfilment")) {
+  | Ok(_) =>
+    JsError.throwWithMessage("expected a revoked role to be unreachable via the token's claim")
+  | Error(_) => expect(true)->toEqual(true)
+  }
+})
+
+testPromise("switching refuses a token this server did not sign", async () => {
+  carolLoggedIn()
+  switch LocalAuth.Login.reissue(~token="not.a-real-token", ~activeRole=Some("Shopper")) {
+  | Ok(_) => JsError.throwWithMessage("expected an unverifiable token to be refused")
+  | Error(msg) => expect(msg)->toEqual("Invalid token")
+  }
+})